opschain admin trust approve

packs:agentspacks:agent-governance

opschain admin trust approve <grant-id> [--server <url>] [--auth-token <token>]

The human half of "grant changes by agents are always human-approved" (the v2 TrustService.ApproveTrustGrant verb). What it does is disambiguated by the grant's state:

• A pending grant (an agent's proposal) is activated — it compiles into the trust snapshot immediately, and the approving administrator is stamped on the grant.
• An active grant carrying a pending revoke has the revoke applied — the grant becomes revoked and the snapshot recompiles immediately.

Anything else — an ordinary active grant, a revoked one, an unknown id — answers 404: there is nothing pending to approve.

<grant-id> comes from opschain admin trust list (pending rows show status: pending; pending revokes show revoke_proposed_by).

Flags

Flag	Meaning
--server <url>	Server base URL. Default: the active context, then OPSCHAIN_SERVER.
--auth-token <token>	Admin bearer token override. Default: your opschain login session, then $OPSCHAIN_ADMIN_TOKEN, then the token stored by opschain admin login for that server.

Output

Always a machine document (JSON unless -o yaml) with the grant's id and its new status — active for an approved grant, revoked for an applied revoke.

Exit codes

Code	Meaning
0	The pending change was applied.
1	The server refused or failed the request (nothing pending, rejected admin token).
2	Usage — wrong arguments, or no server / admin token resolvable.

Named errors

• no pending trust grant or pending revoke with that id — 404, exit 1.
• a server is required — pass --server <url>, set OPSCHAIN_SERVER, or 'opschain context use <name>' — exit 2.
• this command needs a login or an admin token — run 'opschain login', pass --auth-token, set OPSCHAIN_ADMIN_TOKEN, or store one with 'opschain admin login' — exit 2.
• the server rejected the credential — run 'opschain login' again, or check the admin token — exit 1.

See also

• opschain docs cli/admin-trust-reject — the deny path for the same pending rows.
• opschain docs cli/admin-trust-list — find what is pending.
• opschain docs cli/admin-agent-trust-review — the evidence before approving.